Trust, Then Verify: Auditing Every AI Change in Ads

Your agent builds campaigns, shifts budgets, and adds keywords at the speed of a sentence — expert moves, made in seconds. Which is exactly why the question every stakeholder eventually asks about AI in an ad account is some version of "how do I know what it actually did?" The answer should never be "ask the AI" — a system reporting on itself is testimony, not evidence. The real answer is that you hold two independent written records, made by different parties, and they must agree. Google keeps one. The connector keeps the other. Reconciling them is a ten-minute weekly habit.

Two ledgers, kept by different hands

Google's change history is the account's own diary: every material change for the past two years, with the entity, the before and after values, the date, the source and the user who made it. It is kept by Google, on Google's side, and no tool that talks to the account can edit it.

The connector's audit trail is the AI-side record: every call the agent made — tool, target account, success or refusal, the reason, the timestamp. It is kept by the connector, outside the account, and captures things Google never sees, including the calls that were refused before they reached Google at all.

Independence is the point. Either record alone can be doubted in principle; in agreement, they corroborate. This is the boring, load-bearing machinery behind the word trust in an AI-connected account.

What each ledger records — and what neither can

Question	Change history	Audit trail
What changed, old and new values	Yes	Only what was requested
Who made it	Google user identity	Connector seat and tool call
Attempted but refused actions	No — they never happened	Yes, with the refusal reason
Reads (queries, reports)	No	Yes
Changes from other tools and humans	Yes	No
Retention	Two years	Yours to keep

Read the gaps as instructions. Only the audit trail shows refusals and reads, so connector-side logging is your record of what the AI tried and saw. Only change history shows what humans, scripts and auto-apply did, so it is your record of everything-else. And neither ledger records why — the reasoning lives in the AI conversation and in your own decision notes, which is why the weekly review ends by writing two sentences of judgement down.

The retention row carries a quiet obligation. Google's two-year window outlives most reporting questions but not all accountability ones — client disputes, handovers and annual reviews regularly reach past the horizon of whatever surface holds the record. Treat the connector trail and your decision log as the permanent record, and export from Google's side anything you can imagine needing to defend twice.

The weekly reconciliation prompt

Bring the connector's record with you — the audit trail lives on the connector's side, not behind a tool the agent can call, so export or paste the week's entries into the conversation. Then one prompt does the mechanical half of the audit:

Here is my connector audit trail for the last 7 days: every write call, with account, tool, outcome and timestamp. Pull change history for the same window. Match them: list account changes with no corresponding approved call, refused or failed calls, and approved calls whose change I should verify landed as intended. Table, newest first.

Three lists come back, and each has one correct response. Unmatched account changes — identify the other actor (a teammate, a script, auto-apply). Refusals — read the reasons; a refusal pattern is either the system working or a prompt that keeps asking for the wrong thing. Approved-but-unverified — spot-check the two or three that touched spend. Most weeks all three lists are short, which is exactly what makes the ritual sustainable.

Attribution when five people share a roster

Reconciliation collapses if every change says "the AI did it". The fix is structural: per-member connectors. Each teammate connects under their own Google sign-in, so a change lands in Google's change history under that person's identity, and in the audit trail under that person's seat. When several people run AI across shared accounts, "who approved this budget change" has a name in both ledgers — and any seat can be narrowed or revoked without touching the rest. A shared service-account connector produces the opposite: perfect logs of an anonymous crowd.

Investigating a surprise: anomaly to answer in minutes

The audit muscle exists for the day a chart jumps. A concrete shape of the day: Tuesday's spend on a lead-gen campaign runs well above its recent range. The anxious version of what follows is a group chat asking "did anyone touch this?" The audited version: change history shows a budget increase Monday evening attributed to a named teammate's Google identity; the audit trail shows the matching approved call from that teammate's connector seat; the conversation attached to it argues the campaign was pacing under target with the month's evidence laid out. Five minutes in, the question has changed from who did this to was the argument right — which is the question that was always worth the meeting.

The walk is always the same four steps, and — with the trail alongside it — the agent can run them in one conversation:

1. Time-box the anomaly. "CPA doubled on Tuesday" — get the hour range from the metrics, not from memory.
2. Pull both ledgers for the window. Change history first: what changed in or just before the window, with old and new values.
3. Match to the trail. If the change was AI-made, the trail shows the call, the approval and — in the conversation — the argument for it.
4. Judge the argument, not just the outcome. A justified change that aged badly is a revert. An unjustified one is a process fix: tighten the tier, the prompt or the approver.

Without the two ledgers this investigation is a meeting. With them it is ten minutes, and it usually ends in the least dramatic sentence in PPC: "found it, reverted, noted."

What a clean month of logs earns you

The reconciliation habit has a compounding payoff beyond catching problems: it generates the evidence that justifies loosening the reins. A month where every change matched an approved call, refusals were sensible, and no approval turned into a regret is not just reassurance — it is data about which action classes your review adds nothing to. That is the rational trigger for widening autonomy one tier at a time, with the same ledgers watching the wider scope.

Trust in an AI system, done properly, is not a leap anyone takes. It is a balance that two ledgers keep — and hand you, reconciled, every Friday. Start a free pilot and run your first reconciliation prompt this week.